Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3 2026
Summary
Cloudflare reported 18.2 million network-layer DDoS attacks in Q3 2026, up from 13.2 million in Q2. Short-burst attacks surged 208%, while attacks exceeding 1 Tbps fell 69%.
Key points
- Cloudflare said it autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026.
- Network-layer attacks rose from 13.2 million in Q2 and 10 million in Q1; Cloudflare linked many attacks to booter or stresser services.
- Short-burst attacks lasting under 10 minutes and below 1 Gbps increased 208%.
- Attacks exceeding 1 Tbps declined 69%, from 805 in Q2 to 251 in Q3; Cloudflare cited law-enforcement actions as a likely factor.
- Cloudflare warned that new variants, including Dysphoria and Evooo1Bot, have emerged.
- DNS amplification attacks increased 215% and accounted for 3.43% of network-layer attacks, while CLDAP floods declined.
- Media, production and publishing; IT and services; gambling; software; and telecommunications were among the most targeted industries.
Article Details
- Publisher
- Cloudflare (quarterly DDoS Threat Report, shared with The Hacker News)
- Report Period
- Q3 2026
- Scope
- Network-layer and HTTP DDoS activity, attack trends, targeted industries, and countries.
- Sample Size
- Cloudflare reported mitigating 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests during Q3 2026.
- Key Statistics
- Network-layer DDoS attacks increased 38% from Q2 2026 to 18.2 million in Q3 2026.
- Short-burst, low-bandwidth attacks lasting under 10 minutes and below 1 Gbps increased 208%.
- Attacks exceeding 1 Tbps declined 69%, from 805 in Q2 2026 to 251 in Q3 2026.
- DNS amplification increased 215% and accounted for 3.43% of network-layer attacks.
- Cloudflare reported an average of 197,400 network-layer attacks per day, or one every 0.44 seconds.
Threat Actors
AISURUCloudflare said the decline in attacks exceeding 1 Tbps was likely related to law enforcement actions against AISURU; the article provides no further attribution details.JackSkidCloudflare said the decline in attacks exceeding 1 Tbps was likely related to law enforcement actions against JackSkid; the article provides no further attribution details.KimWolfCloudflare said the decline in attacks exceeding 1 Tbps was likely related to law enforcement actions against KimWolf; the article provides no further attribution details.MossadCloudflare said the decline in attacks exceeding 1 Tbps was likely related to law enforcement actions against Mossad; the article provides no further attribution details.
Malware
DysphoriaStill, the threat remains far from completely neutralized, given the emergence of new variants like Dysphoria and Evooo1Bot, Cloudflare warned.Evooo1BotStill, the threat remains far from completely neutralized, given the emergence of new variants like Dysphoria and Evooo1Bot, Cloudflare warned.
Vendors
Countries
CanadaIndonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail, telecommunications,ChinaThe U.S., China, Indonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail,IndonesiaThe U.S., China, Indonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail,Israelthe U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail, telecommunications, andTürkiyeThe U.S., China, Indonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail,United KingdomThe U.S., China, Indonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail,United StatesThe U.S., China, Indonesia, the U.K., and Türkiye emerged as the most attacked countries during the time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail,
Industries
Computer softwareThe most targeted industries include media, production, and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers.Gambling and casinosThe most targeted industries include media, production, and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers.information technology and servicesThe most targeted industries include media, production, and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers.marketingentering the top 10 ranking, fueled by attacks targeting Canada's retail, telecommunications, and marketing sectors.Media, Production, and PublishingThe most targeted industries include media, production, and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers.Retailthe time period, with Canada and Israel entering the top 10 ranking, fueled by attacks targeting Canada's retail, telecommunications, and marketing sectors.telecommunications providersThe most targeted industries include media, production, and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers.